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Abstract: 

WASHINGTON (AP) — A ground safety system to help prevent runway collisions will be provided to 
25 airports across the country, including Bradley International Airport in Connecticut, the Federal 
Aviation Administration said yesterday. The new system, called ASDE- X is designed to give air traffic 
controllers information about the location of planes and vehicles at night and in bad weather when 
visibility is limited. 

Full Text: 

Copyright Patriot Ledger Jun 27, 2000 

WASHINGTON (AP) ~ A ground safety system to help prevent runway collisions will be provided to 25 airports 
across the country, including Bradley International Airport in Connecticut, the Federal Aviation Administration said 
yesterday. The new system, called ASDE- X is designed to give air traffic controllers information about the location 
of planes and vehicles at night and in bad weather when visibility is limited. ASDE-X is similar to the ASDE-3 
ground radar now providing similar data to controllers at the nation's 34 busiest airports. The new units will provide 
added protection to 25 smaller, less busy fields, the agency said. The airports that will get ASDE-X were selected 
through a safety risk assessment conducted by the FAA and Massachusetts Institute of Technology, which 
focused on potential accidents and fatalities. FAA Administrator Jane Garvey announced the decision to purchase 
the equipment at the opening of a three-day airport safety conference in Washington. The 34 busiest airports are 
scheduled to be upgraded by 2002 to a more complex system that will warn of potential collisions and inform 
controllers of the locations of aircraft and vehicles. Garvey said the FAA plans to award a contract for production 
of ASDE-X in September. The number and rate of close calls on runways increased during most of the last decade 
before dropping slightly last year. However, the number of incidents jumped 27 percent in the first five months of 
this year compared with the corresponding period in 1999. 
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Risk assessment and structural integrity aspects of materials behaviour 
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[Headnote] 

Risk has always been an inherent part of everyday life, but quantified assessment of risk is now an 
important part of several different aspects of materials and engineering applications. Risk is taken 
into account as an integral part of the design of many constructions in limit state design through the 
use of partial safety factors to achieve a target reliability, depending on the consequences of failure 
and the uncertainties of the input data and design relationships. Risk is also increasingly being used 
as a basis for decisions on inspection, maintenance, and life extension of engineering structures and 
infrastructure. As part of the effective management of projects, assessments of the financial risks 
both for the client and for the contractor are essential requirements. Environmental risk assessments 
are obligatory for major projects before decisions to proceed can be taken. The current status of the 
application of risk analysis methods to avoidance of failure by plastic collapse, fracture, buckling, 
fatigue, creep, and corrosion is reviewed, and applications in a range of industries are considered. 
The application of risk analysis to the use of new materials, methods of construction, and life 
extension is then briefly explored. Finally, the importance of a proper understanding of both risk 
analysis and materials behaviour for students on degree courses is stressed. 

Sir Monty Finniston is probably best remembered as a major force in the British Steel Corporation and for the report 
of the committee he chaired into the future of the engineering profession, though he was also involved with many 
other companies and organisations.! Although much has changed since his time, his contributions were landmarks 
which laid down paths for future development with much success. Sir Monty's scientific and technical achievements 
were recognised by his election as a fellow of both the Royal Society and the Fellowship (now Royal Academy) of 
Engineering. He also served as President of the Metals Society and the Welding Institute and as Vice President of 
the Royal Society. 

Sir Monty was deputy chairman of British Steel from 1 967 to 1 973, Chief Executive from 1 971 to 1 973, and 
Chairman from 1973 to 1976, during which time the company was a nationalised corporation under public 
ownership. It had become a sprawling assembly of many different works with poor efficiency and profitability. Under 
the leadership of Sir Charles Villiers, Sir Monty Finniston, and Sir Robert Scholey, British Steel was turned round so 
that its current successor, Corus, is one of the most efficient producers of high quality steel and aluminium in the 
world. 

The Finniston report, as it became universally known, laid the foundations for abolishing the ineffective Council of 
Engineering Institutions and replacing it with the Engineering Council. However, the government of the day did not 
follow Sir Monty's recommendations in full, and the Engineering Council had a difficult birth and early life. Sir Monty 
had wanted the new council to provide leadership and to be a driving force in raising the status of the engineering 
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profession and in attracting the best possible quality of recruits for the future, however the relationship between the 
Engineering Council and the professional institutions has continued to be difficult. The increased emphasis on 
engineering applications in degree courses and in the training of engineers and the introduction of the MEng degree 
were both direct results of the recommendations in the Finniston report concerning the 'formation of engineers'. 
These are now of course included in the Engineering Council's document SARTOR ('Standards and routes to 
registration') .2 The reissue of this document, with the basic requirement for a four year MEng degree course as the 
main route to Chartered Engineer status, with 24 A level points as the entry requirement for 80% of the cohort, and 
a three year BEng degree with an entry requirement of 18 points leading to Incorporated Engineer status, is 
currently causing major changes in university level provision of training. 

By the nature of his character and through the responsibilities he bore, Sir Monty was used to having to weigh up the 
information available and take decisions allowing for incomplete information and uncertainties. As such he had an 
inherent grasp of the concept of risk. He was always keen to learn and to take advantage of new technologies and 
new developments and would have been fascinated by the potential advantages of risk assessment, although he 
might well have been sceptical about accepting numerical results absolutely! 

The nature of risk 

A dictionary definition of risk is 'the chance of loss or injury*. The general public has a basic perception of risk in 
connection with everyday activities, which is usually manifest as a perception of injury or death. Some figures for 
accidental deaths and injuries requiring hospital treatment in the UK for 1 999 are given in Table 1 . It can be seen 
that the number of deaths from road accidents is slightly less than the number of deaths from accidents in the 
home. If these figures are divided by the current total UK population of 59 million, the results give a probability of 
death per person per year of 533 x 10 A sup -5 A for road accidents and 667 x 10 A sup -5 A for accidents in the home. 
The table also shows that the number of persons injured in the home requiring hospital treatment is over 700 times 
the number of deaths and about 4-5 times the number of persons with sporting injuries requiring hospital treatment. 

There have been two authoritative reports on risk published by the Royal Society, in 19833 and 1992.4 

These reports include some statistics on deaths, a selection of which are presented in Fig. 1 as deaths per 
thousand persons per hundred thousand hours activity. The time base for these figures is chosen to approximate an 
average life of hours at work. It should be noted that the vertical scale in Fig. 1 is logarithmic. Expressed in this way, 
the risks of death from smoking and travel by air or car are approximately the same or somewhat greater than those 
from accidents on construction sites, in factories, or in the home. It can be seen that on this basis the risk of death 
from collapse of buildings is over four orders of magnitude lower than the highest level shown in Fig. 1 . However 
great care is required in the interpretation of statistics in this field. It is not clear that the same time denominator of 
105 hours activity is applicable to the different activities in this table. Transport statistics are often quoted as deaths 
per passenger mile or kilometre, although a more realistic format is considered by some to be deaths per 
passenger journey. In the scientific field risk has a more precise definition, as follows: risk is the product of the 
frequency of occurrence of a given adverse event and the consequences of the event occurring, which can also be 
interpreted as the product of the probability of occurrence of an adverse event and the consequences of the event. 
All Chartered Engineers are expected to have a basic understanding of the concepts of risk, and a guidance 
document to assist in this has been issued by the Engineering Council. 5 

Figure 2 shows another way of presenting this type of information. Here the frequency of events per year which 
cause more than N deaths is plotted against N itself for a number of common activities. The results for air, sea, and 
rail travel and for failure of dams are taken from actuarial figures. The figures for accidents involving nuclear 
reactors and public assemblies are based on modelling calculations. The difference between the group of the top 
four items in Fig. 2 and the two at the bottom is extremely significant. Clearly the general public is prepared to live 
with the level of risk involved in everyday activities such as travel, although any major accident leading to a 
significant number of deaths does cause great concern. Such accidents are usually investigated by a public inquiry 
which in turn leads to recommendations to try to ensure that similar events are avoided in future. Engineering 
activities are expected to work to a completely different level of risk than that which members of the public may be 
prepared to accept when they have a free choice. This raises the concept of 'perception of risk', which has been 
addressed by the Health and Safety Executive (HSE) in discussion documents6-$ and by the Standing Committee 
on Structural Safety,9 and was the subject of this year's Royal Academy of Engineering Lloyd's Register Lecture. 10 
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1 Risks of death from various causes expressed as 
deaths per thousand head of population per hundred 
thousand hours of given activity 3 
2 Annual frequencies of given types of accidents causing 
more than N deaths 



Table 1 .' Some figures far injunes n> the UK in 1993' 
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Table 7 



Figure 3 shows proposals by the Nordic countries for acceptable target levels of risk for different types of 
engineering construction. It should be noted that on a plot of frequency/probability of occurrence versus 
consequences using logarithmic scales, constant risk is represented by a straight line, so that each category in the 
figure is a line of constant risk. This can be compared with the figures put forward by the HSE as a basis for the 
ALARP Cas low as reasonably practicable') principle shown in Fig.4,6 which suggests the following three main 
regions on a risk diagram: first, where the product of frequency F and consequences N is greater than 0' I per year 
the risk is unacceptable; second, the ALARP region is where 10-' >FN> 10-4; and third, where FN< 10- the risk is 
negligible and acceptable. In the ALARP region it is required that control measures be taken to drive the residual 
risk towards the acceptable region. If society expects risk reductions, the residual risk in this region is only tolerable 
if such reductions are impracticable or require action grossly dispropordonate to the reduction in risk achieved. 
Comparing Figs. 3 and 4 it can be seen that the Nordic countries' proposals are all in the acceptable region, with the 
exception of the risks relating to masts and offshore structures which fall at the bottom of the ALARP region. 

Risk assessment methods are now used widely in the nuclear, offshore, general structural, and chemical 
engineering industries amongst others, although in different ways. In most cases risk assessments are part of an 
overall picture and are used for guidance and ranking rather than for attempting to determine absolute values of 
risk. This is partly because of the lack of firm data or because the methods are relatively young in development. 
Often, risk assessment is carried out using event tree or fault tree analyses, as shown in Fig. 5 (the 'hazard bow 
tie'), which enable logical tracing of all the factors leading to or from hazardous events. 



Application of risk assessment methods to design 



Limit state design 



In the UK over the past twenty or so years there has been a major shift in the design of structures towards the use of 
limit state design. The basic concept is that a structure should be designed so that the probability of failure should 
not be greater than a target value allowing for uncertainties in the loading effects and for scatter or uncertainties in 
resistance effects including scatter in material properties. The previous approach to design, known as allowable 
stress design, had been that there should be a safety factor between the maximum stresses in the structure 
produced by the maximum expected loading and the material strength (usually yield strength in the UK). The major 
difference occurs with redundant structures where failure by plastic collapse requires the formation of a mechanism 
with a number of plastic hinges, and these hinges may develop at different loads. This means that the structure may 
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have a considerable reserve of strength above the condition when yielding first occurs, which would be the condition 
governing an allowable stress design. 
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3 Acceptable target levels of risk proposed by Nordic 
countries for various engineering constructions 

4 Classification of tolerability of societal risks proposed 

by UK Health and Safety Executives 

5 Schematic diagram of relationship between event tree 

and fault tree analyses: the 'hazard bow tie' 



Use of risk assessment methods in this way requires the estimation of the probability of failure. This is the basis of a 
whole subject area known as reliability analysis. In principle the determination of the probability of failure requires 
the solution of an equation which expresses the relationship between all the relevant variables which affect failure 
by a particular mode, including allowing for the uncertainties or scatter in these variables. The complete 
determination of this requires the solution of the convolution integral between expressions for the load and 
resistance effects in a failure equation. In practice it is rarely possible to carry this out when there are many variables 
involved. However, there are a number of approximate methods which can be used to produce good estimates of 
the probability of failure. The most popular of these are first order second moment methods and Monte Carlo 
simulations. 



First order second moment methods involve estimation of the reliability index [3 through a numerical procedure 
applied to solve a failure equation for the particular mode of failure under consideration. This reliability index is 
uniquely related to the probability of failure when the distributions concerned are normal distributions. The easiest 
way to see the meaning of the reliability index is shown in Fig. 6 for the relationship between load effects and 
resistance effects when the distr ibutions of both are normal. The failure margin M can be written in general terms as 



Enlarge 200% 
Enlarge 400% 



where iR, 'L are the means and SR, SL the standard deviations of the resistance and load distributions respectively. 
By use of variables reduced to standard normalised space, Hasover and Lind"1 showed that the reliability index 
could be regarded as the distance from the origin to the failure surface plotted in the n-dimensional space of the 
failure equation. This is shown for two variables XI and XZ in Fig. 7. The value of (3 can then be estimated by 
iterative numerical techniques which start with the mean values of the variables satisfying the failure equation and 
an arbitrary value of (3 and then slide along the failure curve until the minimum value of (3 is found. The design 
point is the position at which the variables have their most probable values for failure. A key issue is that although 
the procedure is strictly applicable only to normal distributions, it is possible to transform other types of distribution to 
equivalent normal distributions with the same values of probability density function and cumulative density function 
at the design point, as shown by Rackwicz and Fiessler.l2 
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To apply these techniques it is necessary to have a failure equation for the mode of failure being considered, and 
data on the distributions of each of the variables involved. Limit state design is effected in practice by the use of 
partial safety factors in which separate factors are applied to each of the input variables, and the structure is 
designed to fail under the action of these additional factors. The factors are used to multiply up loading effects and 
to divide into resistance effects, the magnitude of these factors being decided by a calibration exercise using one of 
the higher level methods to estimate the probability of failure as discussed in the next section. Although partial 
safety factors are an inherent part of limit state design codes for structural engineering, including in European 
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codes, they have generally only been used for failure by yielding or buckling. 
Fracture/plastic collapse 

For reliability analysis applied to fracture and plastic collapse it is convenient to use the BS 7910/R6 failure 
assessment diagram"3 (F ig. 8) and associated failure equations. The failure margin can be written as 



Enlarge 200% 
Enlarge 400% 



where K A sub l A is the applied stress intensity factor given by K A sub l A = Y(omega)(pia)1/2 t K A sub r A is the permitted 
fracture ratio from the failure assessment diagram at the relevant value of the collapse ratio Lr, and K'\$t is the 
relevant fracture toughness. 




6 Level 2 reliability analysis graph 7 Reliability index 
beta shown as distance from origin to failure surface 
plotted in n-dimensional space of failure equation!2 

The basic reliability analysis is carried out for a single defect with assumed uncertainties in estimates of its size, in 
which case the resulting probability of failure is per defect. This can be extended to a distribution of defects of 
different sizes, also with uncertainty in sizing, by discretising the distribution into a series of individual defects and 
combining the results for the whole distribution. This requires account to be taken of the total number of defects 
present or the defect incidence rate per unit length of weld and the length of welding present. 

A number of computer programs have been developed in recent years, including one at UMIST called UMFRAP, to 
carry out calculations to determine the reliability index for fracture, plastic collapse, and fatigue assessments based 
on fracture mechanics prin 

ciples. Examples of results from such calculations will be given in the next section. 

Although partial safety factors have been used for some time in limit state design codes for yielding and buckling 
failure they have not been widely used in connection with fracture failure. An optional treatment was included in the 
1 991 version of PD 6493 and this has been updated for the 1 999 issue of BS 791 0. The basis of partial safety 
factors for fracture is shown in Fig. 9 on the same basis as the level 2 reliability analysis treatment of Fig. 6. Here 
the resistance effects are represented by K A sub r A K A sub mat A (which includes both yield strength and fracture 
toughness) and the load effects by Kl (which includes both stresses and crack size), in both cases with distributed 
values. For simple design or assessment purposes each of the variables in the load and resistance effects is 
represented by a single 'characteristic' value. This may be an upper bound for load effects (say mean plus one or 
two standard deviations) and a lower bound for resistance effects (say mean minus one or two standard deviations), 
although mean values may also be used in some cases. Figure 9 shows the characteristic values of the load and 
resistance distributions as CL and CR respectively and also shows the design point as the intersection between the 
distributions where failure is most likely to occur. The overall partial factor on load effects yL can be defined as the 
ratio Lp/CL, where Lp is the value of the load effects at the design point, and the overall partial factor on resistance 
effects YR can be defined as the ratio CR/RD, where RD is the value of the resistance effects at the design point. ( 
In fact Lp = RD, but they are described separately here for explanatory purposes). Partial safety factors on the 
individual variables which contribute to either load or resistance effects are then determined by a calibration 
procedure in which they are applied to characteristic values in the failure equation and tuned to give a required 
target probability of failure. Thus the values of partial safety factors for a given application depend on the target 
reliability required and the variability/scatter of the distributions of the variables concerned. This exercise has been 
carried out recently to determine partial safety factors for fracture/plastic collapse in BS 791 0,1 3 for target 
probabilities of failure of 2-3 x 10-1, 10-3, 7x 10-5, and 10-5 and for different coefficients of variation of stress, defect 
size, fracture toughness, and yield strength. The target failure probability of 7 x 10-5 is that adopted as the basic 
requirement for design of steel structures to EuroCode 3 and hence the fracture requirements of BS 791 0 have 
been derived to be entirely consistent with general structural codes. 
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Fatin ... Fatigue refers to the growth of cracks with number of cycles applied and hence introduces time into risk 
assessments. For fatigue treatments it is possible to consider either the S-N approach or the fracture mechanics 
approach based on th e Paris Law 

Enlarge 200% 
Enlarge 400% 

In the reliability approach, each of the variables or constants' in the Paris Law can be regarded as having a 
distribution. Thus the initial defect size distribution grows to a new distribution at any time after application of fatigue 
damage. After any specified amount of damage, the probability of failure by plastic collapse or fracture can be 
estimated by using the instantaneous defect size distribution as an input to the analysis discussed in the previous 
section. 










Enlarge 200% 




Enlarge 400% 
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8 BS 7910/R6 fracture assessment diagram'3 9 Partial 
safety factors for fracture shown on same basis as level 2 
reliability analysis plot in Fig. 6 



The UMIST program UMFRAP has been used in a recent research project concerned with the reliability of flooded 
member detection (FMD) for offshore structures. The principle of FMD is the same as that of "leak before break' for 
pressure equipment. The bracing members of offshore platform structures are usually sealed before the platform is 
placed in the sea and hence should be air- and watertight. If cracking develops in service to the extent that it 
penetrates the wall thickness, it will be possible for water to get into the interior of the member. The presence of 
significant amounts of water inside these members can be detected by either radiographic or ultrasonic testing 
methods. This type of inspection can be carried out much more quickly than conventional nondestructive testing of 
all the welded joints and is effectively a screening method to confirm that major damage has not occurred. 
However, for FMD to be effective it is necessary to demonstrate that members can tolerate the presence of through 
thickness cracking without failure by fracture or plastic collapse. There must also be a sufficient margin between 
inspection times to ensure that cracks not causing leakage at the time of one inspection will not grow to failure 
before the next inspection. The full assessment of risk involves consideration of the consequences of failure of 
individual members and this depends on the degree of redundancy in the particular structure concerned. UMFRAP 
has been used to determine the change in probability for growth of cracks to cause leakage or failure by 
fracture/plastic collapse with fatigue damage S3N for a range of different thicknesses, defect sizes and shapes, and 
material properties. Examples of the results are shown in Fig. 10. 

Data on statistical distributions of defects in welds in two major offshore platforms were collected by EQE Ltd from 
inspection records at the time of fabrication as part of this same project (note that all significant defects were 
repaired). The brace members were fabricated from 'cans* with a series of circumferential butt welds (brace 
makeup welds), and they were welded into the structure by final circumferential butt welds to stubs at each end 
(brace closure welds). The closure welds had to be made by welding from the outside only and hence had 
somewhat more/ larger defects in their original distributions. The analyses were carried out both for the distributions 
derived from the inspection data and for postulated individual single defects of height 3, 6, 10, and 15 mm. Figure 
10a shows the results for probability of leakage against S3N whilst Fig. lOb shows probability of fracture/plastic 
collapse against S3N for each of the defect cases. The standard design curves for butt welded joints for offshore 
structures are based on a relationship S3N=1 14 x 1012 (N, mm units) and thus if a particular joint was designed 
right up to the limit, this value of S3N would correspond to the design life in years. If the actual design life of a joint is 
D years and the service life to a particular time is Y years, the amount of fatigue damage S3N at this time should be 
(Y/D) x 1 .4 x 1012. The form of analysis leads to results in terms of probability of failure per defect. To obtain results 
for the probability of failure per member it is necessary to have available an estimate of the number of defects of the 
different types present from data on defect incidence rates, and this was also collected by EQE. The results are 
strictly conditional failure probabilities, since the calculations at any stage assume that failure has not occurred 
previously. The overall probability is then obtained by multiplying the conditional value obtained by the survival 
probability up to that stage. In practice this makes little difference until the conditional failure probabilities are 
sufficiently high that they would be unacceptable for practical safety requirements. 

It can be seen from Fig. 10 that for the particular assumptions made for these cases, the probability of leakage is 
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higher than the probability of fracture for corresponding defects and amounts of fatigue damage. This particular 
conclusion is dependent on the thickness involved (which influences particularly the stage at which leakage occurs) 
and the fracture toughness. It can also be seen that the distributions of defects from the fabrication records give 
lower probabilities of failure per defect at any given level of fatigue damage than the individual defects. The 
absolute levels of probability of leakage or fracture from the defect distributions were very low until S3N values in 
excess of 101 1 were reached. As expected the individual defects show increasing probability of both leakage and 
fracture with increasing size. In particular the larger defects show relatively high failure probability levels compared 
to normal acceptance targets. The overall conclusions from this work were that flooded member detection was a 
satisfactory screening method for finding cracks which had grown from rogue large defects escaping detection at 
the fabrication NDT stage, provided that the material toughness was high or the structure had sufficient redundancy 
to tolerate a failed member. 



|! - \ 
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10 Probabilities of failures resulting 
from a leakage or h fracture/plastic 
collapse for various defects in 20 
mm thick plate: data derived from 
fatigue reliability analysis using 
UMFRAP 

Creep There appears to have been only limited application of quantitative risk analysis techniques in the field of 
creep failure. However in principle there would appear to be no reason why risk assessment methods should not be 
used provided sufficient data on material properties are available. Some work has been done by a group at 
Southwest Research Institute! covering both creep and fatigue interactions. The underlying failure equation adopted 
for creep crack growth was fracture mechanics based 





Enlarge 200% 


Enlarge 400% 







Total life is then obtained by integrating the combined crack growth equation to determine the number of cycles for 
the crack to grow from a given initial size to a limiting final size and calculating the time from the cyclic rate. 
Millwater et a1 .14 include an example based on a probabilistic treatment of these equations for a rotor from a 
steam turbine. The approach they used is not given in detail but is described as an 'advanced mean value' 
algorithm. The initial crack size was taken as 0'5 mm and failure was assumed to occur when the crack reached 
85% of the section thickness. The results are shown in Fig. 1 1 , from which it can be seen that the predicted 
probability of failure is becoming unacceptable for major engineering plant after some 20 000 hours. Clearly, with a 
design life of the order of 200 000 hours, regular inspection of the component in service would be necessary unless 
action could be taken to reduce the crack growth rate. By consideration of the sensitivity factors in the probabilistic 
approach it is possible to identify the factors contributing most to the problem. In this case the authors identified the 
variability in the material constant H as being the most significant, and further testing and data collection were 
recommended to try to reduce the uncertainty in this parameter. 

The method described here has some similarities to the first order second moment approach described above for 
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fracture and fatigue. In principle the equations controlling creep and fatigue behaviour can be written as a failure 
equation and the first order second moment method used to predict probability of failure at any given time. Millwater 
et al. indicate that their method required about 200 creep crack growth analyses,14 whilst to compute a probability 
of failure by Monte Carlo simulation would require a minimum of 106 samples. 

Corrosion Most of the applications of risk analysis to corrosion have been of the qualitative rather than the 
quantitative kind. There is increasing interest in this area and computerised risk assessment programs are 
beginning to be used. For example, organisations such as DNV, TWI Riskwise, Tischuk, and others have now 
produced such packages which are effectively knowledge based advisory systems. The difficulty with applying 
quantitative risk assessment methods to corrosion lies in the complexity of corrosion processes and the various 
different detailed mechanisms which can occur and their sensitivity to local conditions. For corrosion risk 
assessment, John et al.16 have identified the corrosion processes given in Table 2 which have to be considered. 
For qualitative assessments the rate of corrosion may be divided into categories, of which John et al. suggest four: 
extreme, high, medium, and negligible, with associated assessed corrosion rates of >0.5, 0.3-0-5, OM-0.3, and 
<0O1 mm/year respectively. The consequences of failure may also be divided into qualitative categories such as 
those given in Table 3. 



11 Probability of creep related failure of steam turbine 
rotor calculated by Millwater et al." 

Qualitative risk assessments are often carried out using a matrix of the form shown in Fig. 12. Here, frequency of 
occurrence is shown on one axis and consequences on the other. Different squares of the matrix are given different 
colours to represent different degrees of risk. Figure 12 is divided into three categories for frequency and 
consequences but sometimes four or even five categories are used. Each component or structure is assessed for a 
particular mode of failure. Action is then decided depending on which square of the matrix locates the resulting 
combination of frequency and consequences. It should be noted that it may be decided to take different 
precautionary action when major consequences are combined with low frequency than when minor consequences 
are combined with high frequency. A more sophisticated version of this approach is shown in Fig. 13, where the 
matrix is five by five and the number of risk categories is four. 17 

Most of the above approaches to risk assessment for corrosion are based on experience records or judgement to 
estimate a figure for the frequency of occurrence. Only limited work has been done to estimate probability of 
occurrence from probabilistic models of corrosion. Work on reliability based design for control of COZ corrosion 
was reported by Edwards et al.l8 using developments of equations by de Waard and Milliams.l9 Edwards et al. 
carried out full level 3 reliability analyses to give results for perceived probability of failure for two corrosion modes 
and five assumed cases of efficiency of inhibitor performance. The results were presented as probability of failure 
against life in years, but the scale for the probability of failure was linear from 0 to 07, which is much too insensitive 
for normal safety requirements. 

Corrosion rates are often expressed in the literature in terms of mm/year, implying a linear rate for a particular 
material environment combination and corrosion mechanism. Extensive research has been carried out into 
corrosion rates for different mechanisms and the linear rate is a simplification for practical purposes. Laycock et 
al.20 analysed data on pitting corrosion to find distributions for pit depths and their rate of development. Their prime 
objective was to estimate the maximum pit depth since this would lead to leakage. They found that pit depths at any 
time followed an extreme value distribution and that mean pit depth typically followed the power law relation x=atb, 
where x is the mean pit depth, t is time, and a, b are constants depending on the material and environment. 
Typically b lies in the range 033-0-6, so that the assumption of linear growth with b =1 is likely to overestimate 
corrosion rates. This power law model can be used to predict the time for the first pit to penetrate the thickness, or 
average material loss through general corrosion. It is therefore possible to construct reliability models which would 
cover leakage or which could be used in conjunction with fracture/plastic collapse failure models taking account of 
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the reduction of cross-sectional area with time resulting from corrosion. It would appear however that so far the 
interaction with other modes of failure and the use of quantitative reliability analysis have not received much 
attention. 
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Risk based inspection Risk assessment methods are becoming increasingly widely used as a basis for determining 
where and how often to inspect structures and components. This is happening more and more in the nuclear, 
offshore, and petrochemical industries and is being explored in the field of bridges. The direct application of this 
approach requires the subdivision of a structure into separate individual components followed by separate 
assessments of the probability of failure of each component by any relevant modes and assessment of the 
consequences of failure. The amount of data generated is considerable and the use of computer database 
management systems is becoming commonplace. The risks associated with the different components are then 
ranked using scoring schemes for probability and consequences, although these are usually judgement/experience 
based rather than using results of reliability analyses directly. 

Recommendations for risk based inspection are being developed by the American Petroleum Institute for the 
petrochemical industry using both qualitative and quantitative approaches.zl The qualitative approach uses a five by 
five likelihood/consequence matrix. Users are required to complete a questionnaire which leads to a score for each 
answer and a cumulative result for likelihood and consequences. The position in the matrix determines the extent 
and frequency of inspection required. The quantitative approach is much more complicated with many more rating 
factors, but these are based on judgement and experience and do not appear to use reliability analysis explicitly. 
Application of risk analysis to new materials In principle it is possible to apply risk analysis techniques to any 
structural situation and any materials provided that failure equations exist for the relevant modes of failure and that 
there are sufficient data to define the material properties and their scatter/variability. Herein lie the difficulties, 
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however, and it would be true to say that complete dependence on risk assessment methods is better reserved for 
mature situations where there is confidence that the failure mechanisms and material variability are fully 
understood. Once the conditions governing failure are fully understood, to the extent that reliable design equations 
are available, and once sufficient reliable data are available, risk analysis can provide valuable insight into where 
benefits might be obtained without compromising safety. Risk analysis is not a substitute for good practice and 
experience. It can however provide a rational basis for decisions, provided it is soundly based. Two examples will 
now be given of the need for caution. 

There is considerable interest in the use of high strength aluminium alloys for a range of transport vehicles, 
including cars, trains, and ships. These materials show favourable strength to weight ratios and can be produced in 
complex extruded shapes. Two particular problems require very careful attention by designers following this path 
with welded construction. First, the dynamic response of vehicles made of these materials may be such that 
vibrations may lead to fatigue crack growth problems. Thus it is essential to estimate the natural frequency of 
vibration of the structure or component and ensure that it is well removed from any potential exciting frequencies. 
Second, it is well known that the heat affected regions alongside welds in heat treated alloys may be significantly 
softer than the parent material and it is not uncommon to use weld metal which undermatches the parent material 
strength. Whilst the undermatching effect can be taken into account in conventional design either by use of a weld 
efficiency concept or by placing the welds at less highly stressed locations, a problem arises under extreme 
loading conditions. The presence of a localised weak band of material can lead to failure under extreme loading at 
this position without the benefits of more widespread plasticity and ductility to absorb energy before failure. It would 
be interesting to treat both of these problems on a risk assessment basis to quantify the relationship between 
probability of failure and material properties and loading conditions. There is also increasing use of plastics and 
composites in a wide range of industries. The distribution of use of composites among different industries is shown 
in Fig. 14a and the distribution of types of composite in Fig. 14b.22 The offshore industry is among the leaders in 
adopting use of composites, particularly for fire and blast protection. Again however it is important that sufficient 
research is done to understand the failure mechanisms and the material properties before these materials can be 
used with confidence in critical situations. It would be advantageous for this research to be done in an environment 
of risk assessment to obtain optimum utilisation. 

A second example concerns the use of carbon fibre material for a high technology structural transport vehicle. The 
design involved tubular members connected by a member with low torsional stiffness. The stress concentration 
effect of the flexing of the walls of the tubular members due to torsion of the connecting member was not foreseen, 
although designers of offshore structures have been familiar with these effects in steel structures for the past twenty 
to thirty years. Cracking and fracture occurred in the tubular members. Risk assessment is of no value unless the 
appropriate structural behaviour and modes of failure are identified and correct failure equations applied. 
Conclusions The concept of risk as the product of the frequency of occurrence of an adverse event and the 
consequences of that event occurring is well established and is now widely used in industry. There is a significant 
difference between the risks which members of the general public are prepared to take with a free choice of their 
actions and the risk level which industry is expected to achieve to protect the public. Risk assessments can be 
carried out on a qualitative or on a quantitative basis. Both require judgement and experience and comparisons with 
observed events. There is considerable potential for developments in risk assessments using modelling analysis of 
different failure modes. This is well established in structural engineering in limit state design and has been 
developed on a research basis for fracture and fatigue failure. Quantitative risk assessment for creep and corrosion 
is still in its infancy. Risk based inspection is becoming well established in some industries, particularly the nuclear, 
offshore, and petrochemical industries. 

With the development of new materials and new manufacturing/fabrication procedures there is much to be gained 
from adopting a risk assessment approach at an early stage to ensure that sufficient data are gathered to enable 
statistical distributions of properties to be assembled. It is also clear that it is important that all engineers and 
materials scientists should have a basic grounding in the principles of risk assessment and reliability analysis, since 
this will be a key basis for decisions in many areas of science and engineering. 
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